CISA and FBI Issue Urgent Warning on Third-Party ICS Risks to Critical Infrastructure

Executive Summary

On September 24, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) released a joint advisory highlighting the growing threat posed by third-party access to Industrial Control Systems (ICS). As critical infrastructure operators increasingly rely on external vendors for maintenance and operational support, these connections have become a primary vector for threat actors seeking to gain unauthorized access to sensitive OT environments.

Threat Analysis

The threat landscape for critical infrastructure has shifted toward exploiting the supply chain and third-party service providers. By compromising a trusted vendor, attackers can bypass perimeter defenses and move laterally into the operational technology (OT) networks that manage power grids, water systems, and transportation hubs. This approach allows adversaries to maintain long-term persistence while remaining undetected by traditional IT security monitoring tools.

Technical Details

The advisory specifically targets vulnerabilities in remote access protocols and the lack of granular segmentation between IT and OT networks. Attackers are leveraging compromised credentials from third-party service accounts to gain entry. Once inside, they utilize living-off-the-land (LotL) techniques to map the network, identify ICS controllers, and exfiltrate configuration data. The integration of 5G/LTE routers into industrial IoT environments has further expanded the attack surface, necessitating the implementation of Zero Trust architectures to verify every connection attempt.

Attribution Assessment

While the advisory is broad, it follows a series of documented campaigns by state-aligned actors, including groups like Volt Typhoon and various Iran-linked entities, which have historically targeted U.S. and UK utility providers. These actors prioritize the collection of intelligence on OT operating procedures to facilitate potential future disruption of physical infrastructure.

Implications

The failure to secure third-party access points poses a systemic risk to national resilience. As noted by industry leaders, the frequency of both physical and cyber-sabotage attempts on energy grids is increasing. A successful breach of these systems could lead to automated shutdowns, service outages, and long-term damage to critical assets, as seen in recent incidents involving water infrastructure in the United States.

Recommendations

Operators are urged to adopt the principle of least privilege for all third-party accounts. Key recommendations include: 1) Implementing multi-factor authentication (MFA) for all remote access sessions; 2) Enforcing strict network segmentation to isolate ICS environments from the corporate network; 3) Conducting regular audits of vendor access logs; and 4) Deploying continuous monitoring solutions that provide visibility into OT-specific traffic patterns to detect anomalous behavior in real-time.